45 ms·

Apple Photos phones home on iOS 18 and macOS 15

• xenophonf 2y ago
  Lovely. And this blog post is how I find out the Photos app mysteriously turned iCloud Photos back on. What the fuck? At least "Keep Originals" was still set.
• stefanve 2y ago
  I wonder how much of the people that are being upset about an option that recognizes landmarks and that is build in a privacy minded way are using chatGTP, windows, google or socials The writer of the post admits that he doesn’t understand the very tech lite explanation of Apple nor read about Apple AI in general and the way it was setup. A lot of people are upset that (maybe, but unlikely) Apple knows that you made the 10 billionth photo of the Golden Gate Bridge. But continu using all sorts of services, living in sec camera heavy cities etc. Not an apple fan but from all big tech corporations they have the least amount of interest in mining user data from a business perspective
  • makeitdouble 2y ago
    You're ignoring the part where it's opt-out. We're way passed the point where things are accidently opt-out instead of opt-in, if you want to dig the point, it's something you should touch upon.
  • RyanHamilton 2y ago
    >>Not an apple fan but from all big tech corporations they have the least amount of interest in mining user data from a business perspective I think it's more that they realised they couldn't beat google at that game and hoped to see personal or governmental push back like GPDR in the EU that would then give them an advantage. Which would then give them an advantage. The day they stop having that belief they will invade your privacy.
• synecdoche 2y ago
  Apple decided to siphon user photo derived data without prior consent. The purpose, capacity and risk of said data being in others’ hands we are expected to take their word for. All while not informing users in advance or trusting users to themselves decide to start the siphoning. By doing this they have violated some users trust.
• JBiserkov 2y ago
  > Remember this advertisement? "What happens on your iPhone, stays on your iPhone." 1. Take the biggest downside of your product 2. Advertise the opposite 3. Profit
• sgammon 2y ago
  Apple: Does backflips to protect your data Apple's competition: Steals your data outright Most of this thread: How could Apple act this way
  • bergie 2y ago
    > Apple: Does backflips to protect your data That's what their marketing says. I'm not sure how far you can actually trust that. They're an ad and media company as well.
    • sgammon 2y ago
      I am merely comparing homomorphic encryption, client-side vectorization and ML, and so on, to not doing those things. Nothing to do with marketing. Read the manual
      • RyanHamilton 2y ago
        >>Apple: Does backflips to protect your data Yet they enabled this feature by default. Disabled by default would be easier than a backflip?
        • sgammon 2y ago
          The feature is not unsafe in the first place, so turning it on by default grants useful functionality without risk.
  • ghjfrdghibt 2y ago
    You're kidding yourself if you think apple is in the business of protecting your data beyond marketing itself as such. Just like all it's competition it's in the business of using your data like them.
    • sgammon 2y ago
      > You're kidding yourself if you think apple is in the business of protecting your data beyond marketing itself as such. It is entirely possible to create a business where others ignore user demands, like, say, privacy. Apple does not have a massive advertising incentive to process user data as others do. I am not a huge Apple fan (typing this from my Windows machine), but I am not ashamed to admit that some companies are good at some things, and others at other things (insane idea I know) Apple does not have to homomorphically encrypt your data. They do so because they have "made privacy a feature," as they say in their marketing. You can also just read the research papers or code if you want, since they have published those, too. Have you read those?
• chikere232 2y ago
  As trivia, on mac os, the photoanalysisd service will run in the background and look through your photos, even if you never open Apple Photos. It can't be disabled unless you disable SIP (system integrity protection) which requires a complicated dance of reboots and warnings. It will reenable if you turn SIP back on. It seems Apple are very passionate about analysing your photos for some reason, regardless if you yourself are.
  • hmottestad 2y ago
    Isn’t that running locally on your Mac though?
  • m463 2y ago
    All kinds of nonsense runs and phones home throughout the os. The thing that annoyed me the most is trying to create an account will phone home to apple, such as setting up a local smtp/imap server on the local network.
  • snowwrestler 2y ago
    You may also be shocked to learn that Spotlight looks through every single file on your Mac.
    • talldayo 2y ago
      I was. First by the md_worker processes that mysteriously started pinning all of my CPU cores after a git clone. Then by the realization that MacOS had built a full-text index of millions of lines of source code (it only took a few hours of my Mac being too hot to touch). A lot of Apple's defaults are just plain bizarre. Why the hell is Spotlight seeing source code mimetypes and feeding it to the search index?
      • asdff 2y ago
        For real! When I search for a term the last thing I want is some esoteric plist file but I’ll return dozens of those hits. Is there a way to exclude these I wonder? Limit it to what I have in the default home directory structure lets say and not go into my launch agents.
• thinkingemote 2y ago
  So what can Apple do with this assuming they can send anything not just "landmarks". What metadata about the image do they get? Are images from the web or social media or device screenshots accessible too? Seems at the very least they are getting a database of things, objects and shapes. Can cohorts of users be identified? Useful for ad targeting? They should be able to determine how many devices have a photo of a particular person. Or have a photo of a piece of art. Useful for capturing wanted people and stolen goods! They should see how many times users take a photo of another phone. When and how many users take a photo of a protest. Which side has which colour. Do people take selfies of themselves when sick with a novel pandemic. Do people take more photos of dogs at Christmas than cats. Anything that can be vectorized can be identified. But what data do they get and what could they do with it? It's like telemetry and database of images.
  • dan-robertson 2y ago
    I think the differential privacy and encryption are meant to help with that.
• kureikain 2y ago
  Just ged rid if icloud and apple photos. slow as f*ck, crash all the time once the library get big enough on my mac. damn slow to scoll in the photos app with lot of picture. I switched to https://immich.app/docs/features/command-line-interface https://immich.app/docs/features/command-line-interface and import all of my photo into it. 1.3TB and it's damn fast with all the face detection and ml features.
  • jitl 2y ago
    I have 60k photos using 1.2TB and Photos.app feels faster than Google Photos or Lightroom to me ¯\_(ツ)_/¯
  • user_7832 2y ago
    Is it possible to search immich images via spotlight like one can from iCloud photos? I’d love to jump ship away from iCloud but spotlight search is legitimately helpful and I use it many times a week. It’s saved my bacon quite a few times too (didn’t realize I had eg a document as a photo or pdf instead of email).
• renewiltord 2y ago
  This is exactly the kind of feature I have this app for.
• deleted 2y ago
  [deleted]
• sgammon 2y ago
  It is frankly nothing short of amazing that Apple ships things like homomorphic encryption, and differential privacy, and client-side vectorization, and encrypted vectors, at the scale that they inhabit... and they still get a bad report card back from consumers about privacy. Comparing Apple and Google, or Apple and Microsoft, it seems to me that Apple's track record on these issues is actually not as bad as public opinion might suggest. Meta doesn't even make the list for comparison, and neither does Amazon. It makes me wonder if picking privacy as a strategy is workable in the first place. People trust TLS; people use banking apps on their phone now without thinking. I remember in 2008 or so when people still didn't quite trust SSL. I'm not sure if Apple will be able to bridge the gap here, though, if _all_ of their competition simply chooses not to ship those features. Do customers know the difference? Do they... care? In theory they want their data to be private, yes. But if they are not willing to educate themselves to perform their counterparty obligation in fulfilling "informed consent," there may be no action Apple could take to avoid catching the same bad rap everyone else does.
  • jchw 2y ago
    > It is frankly nothing short of amazing that Apple ships things like homomorphic encryption, and differential privacy, and client-side vectorization, and encrypted vectors, at the scale that they inhabit... and they still get a bad report card back from consumers about privacy. Personally, I don't shy away from criticizing Google, but that's not the point. Apple makes big claims about their privacy practices that neither Google nor Microsoft make, it would be bizarre to hold Google or Microsoft to claims and standards that Apple set for themselves. > Comparing Apple and Google, or Apple and Microsoft, it seems to me that Apple's track record on these issues is actually not as bad as public opinion might suggest. Meta doesn't even make the list for comparison, and neither does Amazon. > It makes me wonder if picking privacy as a strategy is workable in the first place. People trust TLS; people use banking apps on their phone now without thinking. I remember in 2008 or so when people still didn't quite trust SSL. > I'm not sure if Apple will be able to bridge the gap here, though, if _all_ of their competition simply chooses not to ship those features. Do customers know the difference? Do they... care? In theory they want their data to be private, yes. But if they are not willing to educate themselves to perform their counterparty obligation in fulfilling "informed consent," there may be no action Apple could take to avoid catching the same bad rap everyone else does. I've said this elsewhere, but what I really dislike about Apple's strategy regarding privacy is that they treat privacy as a purely technological problem that could be solved if only we had better technology, but they ignore that a huge component of why users have been subjected to so many flagrant privacy violations is because they have zero visibility and zero real control over their computing experiences. Apple would very much like to retain their iron grip on what users are allowed to do on their platforms, as they make a ton of money off of their control of the platforms in various ways, so they have a huge incentive to make sure we're all arguing about whether or not Apple is better or worse than Google or Microsoft. Because sure, I do believe that if we held Google to the same privacy standards that Apple currently has, it would probably kill Google. However, if Apple and Google were both forced to give more transparency and control to the users somehow, they'd both be in a lot of trouble. Despite all of this effort, I think that user trust in the privacy of cloud computing and pushing data out to the internet will only ever go down, because attacks against user privacy and security will only ever continue to get more and more sophisticated as long as there are resourceful people who have a reason to perform said attacks. And there certainly always will be those resourceful people, including in many cases our own governments, unfortunately.
• BlackFly 2y ago
  This discussion got quite long without anyone mentioning the novel technical implementation paper "Scalable Private Search with Wally". Kudos to Apple for researching this, but shame on them for enabling this by default. As a somewhat homomorphic encryption scheme, each query releases some bits of information on what you searching for to avoid using the whole database. Subsequent queries from a given user will generally be correlated enough to build a tracer. Governments or other powerful enough actors can pierce the proxy veil, heck the tracer will be able to deanonymize you with enough queries recorded. How many queries? For me it is too tedious to work out the math from the differential privacy definitions and I already know the landmarks around me: I don't want such a feature.
  • josh2600 2y ago
    Hi, Very curious here as I haven’t seen any papers demonstrating attacks against the differential privacy systems proposed by Apple or Google that successfully deanonymize data. Such an attack in even a test database would be very interesting. Do you have any papers you can cite about this entropic leakage you’re describing?
    • BlackFly 2y ago
      The very difference between somewhat and full homomorphic encryption hinges on this leakage as explained in the paper. The definition of differential privacy as well. They directly admit to leaking a certain amount of information by stating that they apply differential privacy with those given parameters. The issue I am talking about is that such concerns are applied on a single query but correlations across query (the things that actually happen with metadata) aren't considered in the delta-epsilon differential privacy model, by definition. So if you are curious, just read up in general about differential privacy, or this classic: https://gwern.net/death-note-anonymity https://gwern.net/death-note-anonymity Discussed here (possibly in other places too): https://news.ycombinator.com/item?id=9553494 https://news.ycombinator.com/item?id=9553494
• t0bia_s 2y ago
  I'm genuinely surprised that there are many software developers that defend Apple products as great tool for privacy even though we are not able to inspect their code that is closed. Am I missing something or is it just hypocrisy?
  • Argonaut998 2y ago
    It's just hypocrisy. I don't know how people can defend Apple as a privacy company when they phone home more than their Google counterparts. People will say that at least Apple don't have a vested interest in their data since they are not an advertising company like Google or Meta. But Apple collects an absurd amount of data, it is phoning home every second. Some Apple traffic is hard-coded to go through VPNs. Apple has already experimented with ads in Maps. Shareholders demand infinite growth, so it is only a matter of time before Apple dives into ads themselves. The only valid point is that Apple does protect your privacy – only towards other companies. I switched to Apple around 3 years ago because I don't like having my data coupled to Google. But I am regretting my decision, I will probably switch back to Android + Linux instead of IOS + Mac at this rate.
    • t0bia_s 2y ago
      Degoogled Android (like LineageOS) is real thing that many use on daily basis.
• ghjfrdghibt 2y ago
  Every time one of these articles pops up about this sort of behaviour but one of the big tech companies, I'm always struck by the differences in the comments you get. I wonder if Google would be getting the benefit of the doubt like apple is currently getting were Google to implement the exact same thing as an opt-out feature?
  • criddell 2y ago
    It doesn’t seem odd to me. I’m more suspicious of Google’s motives and am even more suspicious of companies like TikTok, Amazon, Xiaomi, and Facebook. There’s a privacy spectrum.
  • dan-robertson 2y ago
    I think sometimes the reactions are different because the facts are different. Your counterfactual seems less likely to me than eg Google photos analysing and indexing each image.
  • Hilift 2y ago
    A short while back, Google implemented what I call "Constantly Opt-Out". Google Photos frequently prompting you to "backup those photos to ...".
• Argonaut998 2y ago
  I think I just noticed a similar thing for search that I'm pretty sure was not there before IOS 18. Going into Settings -> Search there's an option now for "Help Apple Improve Search", enabled by default. >Help improve Search by allowing Apple to store the searches you enter into Safari(!!), Siri and Spotlight in a way that is not linked to you. Searches include lookups of general knowledge, and requests to do things like play music and get directions. If it was there before then it was switched on again.
  • fn-mote 2y ago
    > allowing Apple to store the searches you enter into Safari […] in a way that is not linked to you From deanonymization work even a decade ago it was clear that your search history will completely unmask you. I would need lots of details before I believed that their method of storing the data reliably protected my privacy. (But of course that is not what the quote claims.)
  • fudged71 2y ago
    You’re right. This is another setting turned on by default.
  • replwoacause 2y ago
    Oh damn you’re right. This was turned on by default for me, I don’t think I would have opted into this.
  • ThouYS 2y ago
    thanks man
  • have_faith 2y ago
    This is worse than the OP. What alternative universe is Apple living in where it thinks that defaulting to collecting people’s search histories without consent is OK?
• deleted 2y ago
  [deleted]
• talkingtab 2y ago
  Apple can do this because there are absolutely no significant consequences. In the classical legal world your only recourse to this invasion of your privacy along with falsified advertising is a "class action suit". It is clear from past class actions suits that (remember the batter thing) this does not prevent Apple from doing the same thing again. The problem is the granularity. How do millions of people recover damages when a corporation knowingly (knows or should know) it is acting to enrich itself in a significant manner in small amounts. Let us suppose that an abstraction of the damage from this offense can be quantified at $1 per customer. A significant question is whether this action has any possible benefit to Apple. If it does not then once notified of this action, Apple would immediately (as in the next update of IOS or Sequoia) remedy this feature. So step #1 is someone to send an official letter, perhaps with just a link to this article. Or perhaps someone from Apple is reading these comments and can inform us whether they are aware. Next state is that Apple is aware of this problem (knows or should know) and ignores it. So are you helpless? Or could you file a claim in small claims court seeking to recover $1 for each photo that Apple has unloaded, requesting that Apple delete all photos as well as all data derived from the photos, plus filing fee. Next state. You comment on this post as to how to improve the process and make it faster and easier. [And if you oppose this idea, could you please explain your position in a way that helps others understand?]
• cacao-sip 2y ago
  Apple doing the best in class job for privacy and you guys would rather go after it vs google, meta and others who have significantly much massive issues?
• ngcc_hk 2y ago
  Tbh whilst this should be improved it is more like those who lives and works in free democratic countries with market access by and large complained about their imperfect capitalism, undemocratic and not social enough country. May be it is. But I do not think so by and large. Keep on fight and Lee on pushing. At least Apple has a slogan you can push on.
• neycoda 2y ago
  At least google told me on my phone in a pop-up that it would be doing something like this.
• andybak 2y ago
  Users of my (free, open-source) app seem surprised to learn that we've got zero insight into usage patterns. There are situations where a small amount of anonymous telemetry would be extremely helpful but I'm not going to touch it with a barge-pole. Opt-in makes the data useless - not just in terms of the huge drop in quantity but because of the fact it introduces a huge bias in the data selected - the people that would opt-in are probably not a good sample of "typical users". Opt-out - no matter what safeguards or assurances I could provide is unacceptable to a subset of users and they will forcefully communicate this to you. Don't get me wrong - I understand both the ease at which bad actors abuse telemetry and the ease in which "anonymous data" can prove to be nothing of the kind in a multitude of surprising ways. But it's hard not to feel a little sad in a "this is why we can't have nice things" kind of way.
  • spacemanspiff01 2y ago
    Would there be a way to do the stats gathering on device, then once every few months send a popup with statistics? Not sure what bias it adds Like "hey, we make this app, and we care about privacy, here is the information we have gathered over your usage for the past month, can we send this to ourselves, so that we can use it to improve the app?" And then show human readable form of what data was collected.
    • sofixa 2y ago
      You'd still have extremely biased data - people who blindly click OK on every pop up are not representative of your typical user; people who get nightmares after hearing the word "telemetry" and will gather the pitchforks if they hear any hint of will always refuse, but depending on your app, might be your typical user (e.g. for self-hosted picture sync and catalogue, who is the target audience - people who don't trust Apple/Google/Amazon/Dropbox to store their images privately)
      • afcool83 2y ago
        I do find myself on the “private first” side…but also keep in mind that those who grab for pitchforks in defense of privacy aren’t a representative sample of the typical user either. (A purely statistical statement). It’s very easy to confuse ‘loud protest from a small minority’ and the majority opinion. If a plurality of users chose to participate in an analytics program when asked and don’t care to protest phone-home activities when they’re discovered, then that’s where the majority opinion likely lies.
• chickenfeed 2y ago
  I have no idea what apps are sharing with what. On Android network access is so ambiguous. There's such fuzzy wording. Like when you are asked for location permission to use bluetooth. Even perms like file system access. I don't know what this extends to. Have no idea what it is doing. I recently set up a new ipad. I failed to even work out where Photos ended up. Couldn't work out what was backed up, and what wasn't. How to opt out of everything and opt in piecemeal. Whether the OS/gadget had AI enhancements, what they were or are, whether the apps would have cloud access or not. In fact for an apple device it bugged me with dialogs from the get go. And bluetooth kept turning itself back on. I would say I am technically savvy, but I was pretty clueless. I was quite keen to try out some of the AI photo tools. Like find pictures of such and such, but I didn't get that far as confusion abound.
• atmosx 2y ago
  I have replaced “Apple Photos” with photoprism. I am happy so far. Related blog post: https://www.convalesco.org/notes/2024/09/29/setup-photoprism-in-gentoo-gnu-linux.html https://www.convalesco.org/notes/2024/09/29/setup-photoprism...
• daneel_w 2y ago
  It's been doing this since long before iOS 18. I first observed this behavior already on my 1st gen. iPhone SE with iOS 11 or maybe iOS 12. Every now and then, especially after having taken new pictures with the camera, I'd see the network activity spinner get going whenever starting Photos - and I've never enabled iCloud backups, but rather explicitly always disabled it everywhere I find a setting to do so. With Wi-Fi it'd be a short one second affair, and on cellular it'd take a few seconds more. I also observed the duration of the activity to vaguely extend with the number of new pictures taken between starting Photos. Curiously, when disabling cellular data permission for Photos and having no Wi-Fi connected, the network activity spinner would still pop up and just get stuck indefinitely without ever finishing whatever it's reporting. My gut feeling has always been that it's returning digested machine learning feedback for Photos' facial/object recognition. (add.: since moving from the iPhone 8 and iOS 16 to a modern iPhone and iOS 17/18 this behavior has gone away - at least the network activity spinner doesn't gossip anymore...)
• anonymous344 2y ago
  apple: we respect your... LOL No you don't
• karaterobot 2y ago
  Apple also does this thing where, after a major version update (or, seemingly, random incremental updates) it'll just go ahead and reset your app settings for you. So, make sure to check every single privacy option once a month or so, or just give in and let Apple do whatever it wants.
• dishsoap 2y ago
  You can't even turn on and use a new apple product unless you phone home and ask apple for permission. I'm not sure why this is newsworthy. Apple products are known to phone home more than just about anything else. It would be more surprising if apple photos didn't phone home.
• 0_____0 2y ago
  It sounds like Apple Photos "phones home" by fetching some indices? It doesn't sound like photo data leave the device, but I think Apple's issue is they should have been more clear about how this feature worked and what data is and isn't transmitted. If it works how I think it works, I actually don't see an issue here. I don't think anyone here expects there phone to not "phone home" to check for OS updates by default?
• jamieplex 2y ago
  Also, by the time you find that button to turn it off, Apple already has the info it wanted...
• akho 2y ago
  Most Apple Photos users keep their actual photos on Apple's computers. There are few people who should react to this. Sadly, I'm one of them.
• thih9 2y ago
  Related: Settings -> Siri -> Apps (Siri app access) -> [an app] -> Learn from this app This is on by default for all apps and it “Allows Siri to learn from how you use [an app] to make suggestions across apps”. I found no global setting for all apps. More details: https://support.apple.com/en-mn/guide/iphone/iph6f94af287/ios https://support.apple.com/en-mn/guide/iphone/iph6f94af287/io...
• benterix 2y ago
  Anyone using a hardware firewall with apple devices explicitly balcklisting Apple's IP address range? If so, any interesting issues to watch for?
• mattfrommars 2y ago
  I kept telling people here and on Reddit that Apple is using the whole idea of "Privacy First" on Apple devices as a marketing gimmick. The company has began introducing bloatware into their product and rivaling Windows bloatware. Yet, people perception on Apple bloatware here seem to be, "that's fine".
• mass_and_energy 2y ago
  > Allow this device to privately match places in your photos with a global index maintained by Apple so you can search by almost any landmark or point of interest. Couldn't they just make a k/v database that has coordinates of landmarks and then just pass the lat/long from the picture's EXIF in an API call for lookup in said DB when the user wants to make use of this feature? Isn't this part of why we have geotagging?
• oblio 2y ago
  Womp womp... Who would have thought the amoral money making machine would want to make more money? :-)
• low_tech_punk 2y ago
  Going off a tangent, I wonder if the market reveals survival bias: companies and products that did respect privacy practice (e.g. by asking explicit permission) were not able to harness enough user data to compete with other bad players, and as a result, any company would eventually end up like Facebook or go out of business. Sadly privacy is not a marketable feature, or at least it does not have the ROI as Apple originally believed. I feel the only way to level the play field is to reconsider our regulation framework and treat privacy as a fundamental benefit for consumers.
• k3nx 2y ago
  Maybe this feature is to turn this off? Years ago I went to a concert with some friends. We took pictures standing in front of the stage while the staff was setting up. There were some additional pictures of the show. Nothing in any of the pictures had any information regarding the band names. This was taken with an iPhone 6s, so no "intelligence". In the past year or two I had a new "memories" album. The album title was the artist name that we went to see. At first I thought this was cool, then I was concerned, like, wait, how did they get this information? My guess, the "intelligence" used the GPS info to pull up the venue and with the date figured out who the artist was. The album was the headliner, the group photo was of one of the opening bands. I'm still on iOS 17, and I don't see any other way to turn this feature off. I have an option to reset suggested memories, but that's it. It sounds more like a users are given a choice now, which would be a good thing. If it was enabled pre iOS 18 that kind of makes sense that it's enabled by default now.
• nisten 2y ago
  Whatever embeddings and search history you make on your phone that is "generated locally" goes straight bak to apple by default. They make it impractical for anyone to NOT use iCloud. It's all reality distrotion field marketing bs.
• eleveriven 2y ago
  A silent default opt-in erodes trust!
• sgammon 2y ago
  Worth noting that you need iCloud active in the first place to opt-out of this feature, so it is still opt-in, since it is only ever defaulted to being on for users who proactively signed into iCloud.
  • lapcat 2y ago
    This is not true.
    • sgammon 2y ago
      Ah yes, you're right. I spoke to soon. I just checked on the latest Beta simulator and, sure enough, it is checked, with a fresh install and no iCloud account. At least that proves the service is accessible anonymously (i.e., without an identifying iCloud token)
• ryeguy_24 2y ago
  The big question for me is what data contributes to the global index. I would definitely be unhappy if my own photos (pixels + GPS location) were being added to this global index. For example, if someone takes a picture of my house, could they find the location (reverse image to location lookup) using this service? Does anyone know what comprises this global index?
• deleted 2y ago
  [deleted]
• SebFender 2y ago
  Don't be too worried about what they collect per se they all do and you mostly won't know. Let's worry about how they manage and use it. When it comes to Apple specifically - homomorphic encryption is "common" and well done - it how do they use this encrypted data is the key...
• iluvcommunism 2y ago
  [dead]
• AppleHotelCA 2y ago
  I agree with you 100. I think Apple is doing a couple things fora couple different reasons (all of which I bother me) yet some worse than others It's because it's a Triple (or more) Monetary Win Business Strategy. I'll explain. Has anyone noticed how Apple keeps telling you your storage is "almost full" then wants you to upgrade to ICloud+? Because After selling that expensive phone they don't want to wai to squeeze more money out of you. They set ALZl defaults to open and upload to iCloud, so if you don't change them you are Icloudkng EVERTHING. Which fills up. Plus certain things you can't NOT iCloud bc you don't have a choice. What takes the MOST space and is most important to most people? Photos/Vi. So -) they auto default to upload/iCloud all plus your photos. Then tell you you are out of space and ask you to purchase more and more storage for cost each month from $1-$10. But - ever tried to DOswLOAD your photos back to phone, and downgrade your storage? You can't. I'm almost impossible. The various instructions online don't work. You can do it with dedktop or laptop but even then they will try to reload and further even THEN there are ALZl kinds of bugs and glitches to getting photos back locally only. So first part - they set all to upload and make local only imposssible and downgrading storage impossible. I had to take screenshots and file fraud claims to get them to downgrade m and stop charging me 9.99 and 1.99 each month. But even then. I'm pretty sure they ARE keeping all those photos we supposedly download back OFF iCloud and don't want their storage for AND of course everyone else photos and videos--Why? Second part of strategy (my opinion) - bc they are using ALL our collective photos and videos to Train Large AI models and computers and to run simulations, to prepare for future robots that are more like like, etc. yes U sound a bit conspiracy theorish - but it IS what they are doing! Plus aggregating all the data itself within our devices in photos/videos and other meta data - they can also run that through and sell it, store, make profiles on us, profilers on regions and correlations, etc - all of which is sellable now to various companies AND will be sellable in new ways in the future. So they benefit triple on us. I think there should be federal laws saying -1) All settings must be defaulted to highest privacy (ie closed) and 2) requiring Intentional option in, 3) Plain explanations of what "features and settings do, or how could be used, with clear warnings and subject to Lawsuits for fraudulent inducement and invasion of privacy if those descriptions are understandable by an ordinary reasonable person - NOT an ordinary TECHNICAL engineer. If they can't explain what it does to an ordinary person, it probably is doing stuff that ordinary person WOULD not consent to. And 4 and 5) of new federal laws I wish there - 4) they can't reset or change your privacy settings to make them MORE open after each update, and again req opt-in not opt-out, 5) anyone who does Opt-In - should get metrics of all data disclosed - with a price per amount and data type - PAID back to them. So for example - there should some Global Standards of Data Types - Levels - some more valuable than Others. EXAMPLE/Hypo If it collect "100MBs/amount" of Valuable Level 1 Data, which is Valuaed at $.005/MB then it owes you 100x.005= 5cents. And so on. There should be classifications of data, with Intl standards on the Value of that DATA, and if you did OPT-IN, you get an accounting each month of what data and how much of it did THEY collect, and theyOWE you for collecting it. Bc let's face it - how are they building the powerful computers and AI things they will trillions on? It's on us. Our data. How are making billions in sass and sales- on us, our data. As it stands NOW they ought to pay us even for data we don't opt-in to but try to Opt out of and can't!! And for all past data they've collected. And for my own time, and everyone else's time - Each month when a new update comes out - THAT EACH TIME resets all those settings I spent hours to reset back to close - and to research those hundreds of "Feature Flags" to find out which are good, which probably are NOT good and which Are in between or who know so roll the dice either way. I set all settings to closed bc they auto default to everything open, everything sharing, Bluetooth on, public WiFi on, etc everything "uploading" to iCloud. It takes me HOURs. The Accessibility commands and options alone take me an hour to reset. Yet - even when it's turned off - sometimes my phone turns back on something even without updates bc of bugs of hidden features Apple isn't disclosing. Yet after each update all those settings I spent hours on on phones and Mac and iPad, etc- they default BACK to open. And I spend hours again. And it's taking longer each time, and updates while good for other things- for this it sucks, and updates are WAY more frequent. Makes me crazy. I'm not a hacker or a tech like y'all probably are. So I apologize for my long rant by a novice such as myself. I'm just a normal person who likes to read and research and teach myself things so even though I'm not technical I doread a lot and so I'm not an idiot either. I've been a Mac user for over 20 years. Use to an @mac, then @me, and of course now @icl - things starting really going to shit and having sync/corruption issues and bugs, etc in 2019, got way worse in 2021, and now it's all the time. It's so frustrating though bc everything - is Mac-it's the invested infrastructure of our lives - to use an analogy: it's like Apple/Icloud is a Hotel California. It's used to be a nice hotel though. Now it's a Zombie Apocalypse Hotel California. But there aren't any other "hotels" out there that are any better either I'm afraid.
• stuckkeys 2y ago
  Install proxyman, you can find some interesting things about your favorite beloved iOS. It is not just photos app. They track me, I track them.
• jug 2y ago
  Wow, this was even enabled on our otherwise fairly locked down corporate phones... Normally these features are both disabled and greyed out via "group policies" or whatever Apple calls them.
• sillywalk 2y ago
  I don't care if the device checks it, it uses homomorphic encryption and differential privacy. This is turned on by default. This angers me.
  • guzik 2y ago
    Clearly, in Cupertino, 'enhancing user experiences' without consent is the top priority.
  • bigwordsehboy 2y ago
    "homomorphic encryption and differential privacy" It is new. It is fancy. It is not clear where HE/DP is being used, it depends if the code is written using the Swift toolkit, but even that has paths for exfiltration if used incorrectly. They claim they are using DP in Photos as stated in the article here: https://machinelearning.apple.com/research/scenes-differential-privacy https://machinelearning.apple.com/research/scenes-differenti... But the fact remains they are looking at your pictures. I do not trust them for one fleeting fart in the wind on this. Think about it for a hot second: HE/DP allows you to perform operations on the data without knowing the data, but what if someone goofs an operation and it ends up returning the actual data? Sorry, not buying it. Crypto is hard to get right, and when it is monetized like this for "new features", it is wildly unnecessary and exposes users to more risk.
    • ricardobeat 2y ago
      > what if someone goofs an operation and it ends up returning the actual data That's kind of like saying "they can take a picture of your face and transmit it, but what if someone goofs an operation and sends your actual head instead". Any encrypted data the server has cannot 'accidentally' be decrypted, and as someone else explained in this thread they only send encrypted vectors describing features of the image (building, tree, etc) and not the actual image. It's certainly not a fact that "they are looking at your pictures" [1]. [1] "they" being Apple; the other guys could have backdoored the whole OS and Apple employee's computers for all I know
• gigel82 2y ago
  > From my own perspective, computing privacy is simple: if something happens entirely on my computer, then it's private, whereas if my computer sends data to the manufacturer of the computer, then it's not private, or at least not entirely private. Thus, the only way to guarantee computing privacy is to not send data off the device. +1
• zaroth 2y ago
  I don’t even use iCloud Photos and this was on by default. Very bad move by Apple to ship my photos off my device, without my permission, in any shape or form, I don’t care.
  • newZWhoDis 2y ago
    It’s funny how the wordsmiths come out to defend Apple here. Your “photos” aren’t shipped off-device without your knowledge, just an arbitrary blob of ”metadata” that you can’t audit describing everything about that photo. :) It’s sort of like “I don’t want my WiFi router uploading my house online!” And someone replying “it’s not your physical house, just a map of the house and the real time location of everyone in it! The house never moves!”
  • threeseed 2y ago
    If you don't use iCloud Photos your photos are not shipped off your device.
    • zaroth 2y ago
      I wish it were so! That was true until they turned this feature on by default.
  • mike_d 2y ago
    That isn't what is happening. The author of this blog post has absolutely no idea what he is talking about.
    • JTyQZSnP3cQGa8B 2y ago
      > That isn't what is happening Then why is it happening to me?
• hu3 2y ago
  So it sends your photos to be indexed on Apple servers. Turned on by default. This is probably done to compete with Google Photos which has a great photo search by word feature. With that said, Apple can use whatever privacy measures to protect user data. But at the end of the day, a subpoena can easily force them to hand over data. The best privacy measure is to just not have the data. I guess indexing photos offline in phone is not very feasible yet.
  • thought_alarm 2y ago
    It does not send your photos to be indexed on Apple servers.
    • deleted 2y ago
      [deleted]
    • mentalgear 2y ago
      it literally says it uses global search index on the label below the check mark. It seems more than likely that (now or at least in the long run) they will use user data to enhance this index.
      • 0points 2y ago
        It's funny how one can use "literally" while almost demonstrating illiteracy. It's right there in the help text: > Allow this device to privately match places in your photos with a global index maintained by Apple so you can search by almost any landmark or point of interest. They are saying that they match your photo against their global index. They are not saying that they will add your photo to their global index.
        • hu3 2y ago
          > They are not saying that they will add your photo to their global index. Nobody said that except you.
  • tredre3 2y ago
• walterbell 2y ago
  Was this not announced during the iOS18 'Glowtime' event? Gosh. Thanks for the neon! https://www.cnet.com/tech/mobile/everything-announced-at-apples-glowtime-event-iphone-16-models-apple-watch-series-10-airpods-4-and-more/ https://www.cnet.com/tech/mobile/everything-announced-at-app... https://www.internetsociety.org/resources/doc/2023/client-side-scanning/ https://www.internetsociety.org/resources/doc/2023/client-si... The Internet Society makes the following recommendations based on the European Commission’s proposal: That the European Committee introduce safeguards for end-to-end encryption. That the European Committee prohibits the use of scanning technologies for general monitoring, including client-side scanning
  • bogantech 2y ago
    Should I have to watch marketing events to make sure I'm not being spied on?
    • walterbell 2y ago
      Maybe just the ones with bright neon "Glow-foo" canary branding..
• scosman 2y ago
  "I don't understand most of the technical details of Apple's blog post" I do: - Client side vectorization: the photo is processed locally, preparing a non-reversible vector representation before sending (think semantic hash). - Differential privacy: a decent amount of noise is added the the vector before sending it. Enough to make it impossible to reverse lookup the vector. The noise level here is ε = 0.8, which is quite good privacy. - OHTTP relay: it's sent through a 3rd party so Apple never knows your IP address. The contents are encrypted so the 3rd party never doesn't learn anything either (some risk of exposing "IP X is an apple photos user", but nothing about the content of the library). - Homomorphic encryption: The lookup work is performed on server with encrypted data. Apple can't decrypt the vector contents, or response contents. Only the client can decrypt the result of the lookup. This is what a good privacy story looks like. Multiple levels of privacy security, when any one of the latter 3 should be enough alone to protect privacy. "It ought to be up to the individual user to decide their own tolerance for the risk of privacy violations." -> The author themselves looks to be an Apple security researcher, and are saying they can't make an informed choice here. I'm not sure what the right call is here. But the conclusion "Thus, the only way to guarantee computing privacy is to not send data off the device." isn't true. There are other tools to provide privacy (DP, homomorphic encryption), while also using services. They are immensely complicated, and user's can't realistically evaluate risk. But if you want features that require larger-than-disk datasets, or frequently changing content, you need tools like this.
  • AJRF 2y ago
    > This is what a good privacy story looks like. Not at all. A good privacy story is not sending this data anywhere.
  • chikere232 2y ago
    The nearest neighbour search is sharded, which apple's blog admits is a privacy issue, which is why they're running the DP and OHTTP parts. If apple were to add additional clusters that match "sensitive" content and endeavour to put them in their own shards distinct from landmarks, they defeat the homomorphic encryption part while still technically doing it. The DP part can be defeated with just statistics over time; someone with any volume of sensitive content will hit these sensitive clusters with a higher likelihood than someone generateing noise injected fake searches. The OHTTP part can be defeated in several ways, the simplest of which is just having a clause in a non-public contract allowing apple to request logs for some purpose. They're paying them and they can make up the rules as they go.
• jazzyjackson 2y ago
  I'm moving my family out of apple photos, self hosted options have come a long way. I landed on immich [0] and a caddy plugin that allows for PKI certificate for account access while still allowing public shared URLs [1]* There's also LibrePhotos which is packed with features but doesn't have as much polish as immich. They do however have a list of python libraries that can be used for offline/local inference for things like having an image model create a description of a photo that can benefit the full text search. [2] [0] https://immich.app/ https://immich.app/ [1] https://github.com/alangrainger/immich-public-proxy/blob/main/docs/securing-immich-with-mtls.md https://github.com/alangrainger/immich-public-proxy/blob/mai... [2] https://docs.librephotos.com/docs/user-guide/offline-setup https://docs.librephotos.com/docs/user-guide/offline-setup * Haven't actually tried this plugin yet, my weekend project is setting up my caddy VPS to tunnel to the immich container running on my Synology NAS
  • lurking_swe 2y ago
    i like to self host but i’d never do it for something critical like photos. what if you’re hit by a bus next month? Then your family (probably not tech savvy) need to figure out how to migrate all their stuff to a commercial offering - while dealing with all the emotional stuff after death. it’s just added stress for your loved ones. 100% private is nice but not practical for something like photos in my opinion. unless you have someone in the family that can take over after you’re gone and is very technical.
  • nrki 2y ago
    Immich is amazing, truly great software, and it's oss
    • layer8 2y ago
      It’s still beta though and often has breaking changes that can require updating the server software in sync with the mobile app versions.
  • sneak 2y ago
    Sure, I use Ente and have iCloud Photos turned off, but TFA is referring to what happens in the Apple Photos app, which happens even if you have iCloud Photos turned off.
• walterbell 2y ago
  > On macOS, I can usually prevent Apple software from phoning home by using Little Snitch. Unfortunately, Apple doesn't allow anything like Little Snitch on iOS. On Android, NetGuard uses a "local VPN" to firewall outgoing traffic. Could the same be done on iOS, or does Apple network traffic bypass VPNs? Lockdown mentions ads, but not Apple servers, https://lockdownprivacy.com/ https://lockdownprivacy.com/. Apple does publish IP ranges for different services, so it's theoretically possible to block 17.0.0.0/8 and then open up connections just for notifications and security updates, https://support.apple.com/en-us/101555 https://support.apple.com/en-us/101555
  • mihaaly 2y ago
    It looks sensible assuming that Little Snitch has some high level manager agent inside Apple manipulating the company making these kind of sneaky attacks on customers' privacy that drives the sales of Little Snitch. On the end they will also make them to buy Liitle Snitch for lots of millions or billions for elimination so they can attack customers freely afterwards. Little Snitch hidden agents are smart! I do not assume that Apple managers are that degenerate idiots pushing through trust eroding marginal idiocy like this.
  • fulafel 2y ago
    Apple probably wouldn't allow such an app in their walled garden?
  • dev_tty01 2y ago
    >On Android, NetGuard uses a "local VPN" to firewall outgoing traffic. Could the same be done on iOS, or does Apple network traffic bypass VPNs? Lockdown mentions ads, but not Apple servers, https://lockdownprivacy.com/ https://lockdownprivacy.com/. Why is NetGuard more trustworthy than Apple?
    • walterbell 2y ago
      NetGuard firewall doesn't run on iOS, so there's no point in comparing to Apple. For those on Android, NetGuard is open-source, https://github.com/M66B/NetGuard https://github.com/M66B/NetGuard On iOS, Lockdown firewall is open-source, https://github.com/confirmedcode/Lockdown-iOS https://github.com/confirmedcode/Lockdown-iOS
• timsneath 2y ago
  More on homomorphic encryption here: https://www.swift.org/blog/announcing-swift-homomorphic-encryption/ https://www.swift.org/blog/announcing-swift-homomorphic-encr... Summary: "Homomorphic encryption (HE) is a cryptographic technique that enables computation on encrypted data without revealing the underlying unencrypted data to the operating process. It provides a means for clients to send encrypted data to a server, which operates on that encrypted data and returns a result that the client can decrypt. During the execution of the request, the server itself never decrypts the original data or even has access to the decryption key. Such an approach presents new opportunities for cloud services to operate while protecting the privacy and security of a user’s data, which is obviously highly attractive for many scenarios."
  • deleted 2y ago
    [deleted]
• geococcyxc 2y ago
  Another setting that surprised me with being turned on by default apparently on macOS 15 is System Settings - Spotlight - "Help Apple Improve Search": "Help improve Search by allowing Apple to store your Safari, Siri, Spotlight, Lookup, and #images search queries. The information collected is stored in a way that does not identify you and is used to improve search results."
  • dev_tty01 2y ago
    No, this is not on by default. After system install at first boot it asks if you want to help improve search and it describes how your data will be handled, anonymized, etc. If you clicked on yes it is on. There is a choice to opt out.
    • newZWhoDis 2y ago
      I always say no to all analytics/improvement prompts. Both the search and photos settings were on for me in both iOS and MacOs. Completely unacceptable Apple
    • JTyQZSnP3cQGa8B 2y ago
      You're lying, it is on by default.
    • nechuchelo 2y ago
      I was on by default for me, both after the macOS 14 -> 15 upgrade and after installing macOS 15 cleanly. I wonder if they ask for consent in some regions only.
      • scratchyone 2y ago
        Yeah this seems to be on by default for me as well, I definitely take issue with that.
  • 2OEH8eoCRo0 2y ago
    I love the, "help <megacorp> do x" options. Help? Your market cap is over $3tn. Help yourself! And stop asking how my call quality was.
• dan-robertson 2y ago
  To me it seems like a reasonable feature that was, for the most part, implemented with great consideration for user privacy, though maybe I’m too trusting of the description. I mostly think this article is rage-bait and one should be wary of ‘falling for it’ when it shows up on hacker news in much the same way that one should be wary when rage-bait articles show up in tabloids or on Facebook. It seems likely to me that concerns like those of the article or some of the comments in this thread are irrelevant to Apple’s bottom line. A concern some customers may actually have is data usage, but I guess it’s likely that the feature is off if in low data mode. I wonder if this particular sort of issue would be solved by some setting for ‘privacy defaults’ or something where journalists/activists/some corporate IT departments/people who write articles like the OP can choose something to cause OS updates to set settings to values that talk less on the network. Seems hard to make a UI that is understandable. There is already a ‘lockdown mode’ for iOS. I don’t know if it affects this setting.
  • amatecha 2y ago
    Literally all Apple needed to do was not have it enabled by default. Sending stuff over the network without asking is why trust in Apple is reduced further and further.
    • Klonoar 2y ago
      Apple already communicates home by default. They never even fixed the macOS app signature check that they said they would, and yet people still choose to use the OS. (And to be clear I’m not even bothered by the signature check) At a certain point you have to figure that they realize it doesn’t matter short of some government entity forcing them to stop. At the very least the protections they put in place (homomorphic encryption, etc) are more than I think most other companies would ever bother doing.
    • Schiendelman 2y ago
      [flagged]
      • 2y ago
• ustad 2y ago
  Holy crap! Enabled by default! Thank you for letting everyone know. “Enhanced Visual Search in Photos allows you to search for photos using landmarks or points of interest. Your device privately matches places in your photos to a global index Apple maintains on our servers. We apply homomorphic encryption and differential privacy, and use an OHTTP relay that hides IP address. This prevents Apple learning about the information in your photos. You can turn off Enhanced Visual Search at any time on your iOS or iPadOS device by going to Settings > Apps > Photos. On Mac, open Photos and go to Settings > General.”
• ProllyInfamous 2y ago
  At this point, Mac Mini M4's are cheap enough and capable enough to just purchase two: one for off-line use, another on-. Perhaps this is marketing genius (from an AAPL-shareholder POV)? ---- I'm laughing at the insanity of all this interconnectivity, but an NDA prevents me from typing the greatest source of my ironic chuckles. Described in an obtuse way: a privacy-focused hardware product ships with an undisclosed phone-home feature, letting the feds see every time you use the product (to produce a controversial product, at home). Kick in my fucking door / sue me: it'll just re-enforce that I'm correct about concessionary-allowances...
  • doctorpangloss 2y ago
    Can you be more clear?
    • ProllyInfamous 2y ago
      Computer are inexpensive enough to own both on- & off-line hardware. ---- Even privacy-focused hardware manufacturers will allow undisclosed usage tracking (in order to continue existing, themselves). In my example, the OEM delivers a physical product which allows users to make tangible objects, at home. Every time you launch the hardware's control software (to make more controversial objects), it phones home.
  • threeseed 2y ago
    > letting the feds see every time you use the product This does not happen.
    • Lammy 2y ago
      Wrong. Anything that makes any network request is by definition a privacy leak. The network itself is always listening, and the act of making any connection says that you are using the computer, and where, and when.
      • threeseed 2y ago
• TYPE_FASTER 2y ago
  I think the user should be prompted to enable new functionality that sends data to the cloud. I think there should be a link to details about which data is being sent, how it is being transmitted, if it is stored, if it is provided to 3rd-parties, and what is being done with it. Maybe this is exactly what the GDPR does. But it is what I would appreciate as a user. I have seen how sending metrics and crash dumps from a mobile device can radically improve the user experience. I have also seen enough of the Google bid traffic to know how much they know about us. I want to enable sending metrics, but most of the time it's a radio button labeled "metrics" and I don't know what's going on.
• xbar 2y ago
  Now "What happens on your iPhone stays on your iPhone" seems like it deserves the Lindt chocolates defense: "exaggerated advertising, blustering, and boasting upon which no reasonable buyer would rely."
• amatecha 2y ago
  Completely, 100% agreed: > the only way to guarantee computing privacy is to not send data off the device. > It ought to be up to the individual user to decide their own tolerance for the risk of privacy violations. [...] By enabling the "feature" without asking, Apple disrespects users and their preferences. I never wanted my iPhone to phone home to Apple. Regardless of how obfuscated or "secure" or otherwise "privacy-protecting" the feature is, the fact is that some information derived from one's personal content is transmitted, without prior consent. Even if the information is protected, all network queries are information. A timestamp that proves you took a certain action at a certain time (like taking a photo, assuming stuff is sent to this service immediately upon adding a new photo), from a certain location (by correlating your location information at that time), etc etc.. and that's just the tip of the iceberg. Transmitting information from a user's device without their explicit consent is a violation of their privacy.
  • avianlyric 2y ago
    These issues are all addressed in the Apple blog post that talks about how this feature is implemented. Two steps are taken to deal with these risks: 1) iOS creates additional fake queries, and all queries pass through scheduler that ensures you can use time-of-lookup to either discriminate real queries from fake queries, or identify when a photo was taken. 2) All queries are performed anonymously, with the use of a third party relaying service. So there’s no way for Apple to tie a specific query back to a specific device, or even IP address. Between those two mitigating features. Getting hold of an individuals personal data using this feature requires you to first compromise the targets phone, to disable the fake queries. Then compromise the relaying party to correlate queries back to a specific IP address. If you can manage all that, then quite frankly you’re a fool for expending all that effort. When you could just use your iOS compromise to have the device send you its location data directly. No need to faff about waiting for your target to take photos, then track multiple landmark lookups, carefully collecting a few bits of additional data per query, until you finally have enough to identify the location of your target or targets. The whole thing reminds me of XKCD 538. https://machinelearning.apple.com/research/homomorphic-encryption https://machinelearning.apple.com/research/homomorphic-encry...
• varenc 2y ago
  This whole thing is reminding me of the outrage over Apple and Google's privacy preserving 'Exposure Notification System' system from the Covid years. It defies intuition that they can alert you to exposure without also tracking you, but indeed that's what the technology lets you do. Similarly here, it feels like the author is leaning into a knee jerk reaction about invasion of privacy without really trying to evaluate the effectiveness of the technologies here (client side vectorization, differential privacy, OHTTP relays, and homomorphic encryption). Though I 100% agree Apple should ask the user for consent first for a feature like this.
  • naruhodo 2y ago
    I would love to evaluate the privacy of these technologies. Someone reply with a link to the source code so I can see exactly what it is doing, without having to take an internet rando's word for it. Better yet, let me compile it myself.
    • ok_dad 2y ago
      You had better build your own silicon chips and phone hardware as well in that case.
      • do_not_redeem 2y ago
        Don't let perfect be the enemy of good.
        • Schiendelman 2y ago
          That's what rallying against Apple in the name of privacy is already...
          • do_not_redeem 2y ago
            Are you saying we shouldn't hold Apple accountable for privacy encroachments then?
• yesfitz 2y ago
  What “places” would Apple be able to match that aren’t either obvious or irrelevant? (e.g. “The Grand Canyon” is obvious. The interior of a home is irrelevant.) Maybe the interior of a restaurant? I hate to jump to conspiracy theories, but the mechanism seems like a more effective version of their prior CSAM scanning scheme[1]. Best part? It doesn’t even require iCloud usage. 1: https://www.macworld.com/article/1428633/csam-photo-scanning-icloud-iphone-canceled.html https://www.macworld.com/article/1428633/csam-photo-scanning...
• amelius 2y ago
  Why does Apple keep insisting that I want anything to do with them after I bought the device? Let go of the freaking tether. And let me choose my own photo editing service provider.
  • slashdave 2y ago
    > Why does Apple keep insisting that I want anything to do with them after I bought the device? Um, because that is what their customers are asking for?
  • dangus 2y ago
    You literally can choose your own photo software. You don't have to use Photos at all. Just get another app.
  • Hilift 2y ago
    Perhaps it's the legion of kool-aid drinkers that preceded you and influenced their design.
• globalnode 2y ago
  whats the 'feature' in the app that requires sending a hash off device?
  • fmajid 2y ago
    Apparently, if you take a photo of the Taj Mahal, it will find photos other people took of the Taj Mahal so you can feel inadequate.
  • 0points 2y ago
    It's called "Enhanced Visual Search" and they described it like this: > Allow this device to privately match places in your photos with a global index maintained by Apple so you can search by almost any landmark or point of interest. I guess it's useful if you get very lost and don't recognize the pyramids right in front of you, and forgot you have a GPS in the phone.
• samatman 2y ago
  [flagged]
  • urbandw311er 2y ago
    Oh I dunno. Your comment made me chuckle and I’m largely on the fence on this one but it doesn’t seem too outrageous to say that maybe this is a slight invasion of people’s privacy without asking them to opt in.
• sss111 2y ago
  I am on the latest iOS, just discovered this setting, it wasn’t turned on by default.
  • gwill 2y ago
    odd, i'm also on latest but it was enabled
  • blindriver 2y ago
    Mine was turned on by default, I just checked.
    • Schiendelman 2y ago
      Did you upgrade from a previous version?
  • accrual 2y ago
    Maybe the new setting checks a certain combination of other settings first, like: if (setting_1 && setting_2 && !setting_3) { new_setting = true } Mine was also enabled by default.
    • sss111 2y ago
      I have Photos shared library set up, one of the members of the library is a child account — I wonder if that’s got anything to do with it.
• paxys 2y ago
  So basically - You take a picture. Apple encrypts it and uploads it to their server. The server matches the (still encrypted) picture to a database and tells your device "this picture contains the Eiffel Tower". Later when you search for Eiffel Tower on your device the photo pops up. Is the complexity and security risk really worth it for such a niche feature? It's also funny that Apple is simultaneously saying "don't worry the photo is encrypted so we can't read it" and "we are extracting data from the encrypted photo to enhance your experience".
  • RandallBrown 2y ago
    Is this a niche feature? I use this kind of search very often in my photos.
    • aeyes 2y ago
      What are some example keywords? I have never searched for landmarks, I only search for location. How many landmarks are there to justify sending your data off? Can't the database be stored on the device?
      • mp05 2y ago
        One time in Paris I received a crème brûlée that strongly resembled the face of Jesus Christ, so naturally I took a picture before devouring it. Last night I was able to find the image using the single word "creme". Definitely saved the story.
      • sprayk 2y ago
        cat, pizza, dog, red car, Tokyo, dolphins, garden The usual context is "oh I saw some dolphins forever ago. let me see if I can find the photos..."
        • aeyes 2y ago
          All of these worked in the past without sending any data off the device. But now you suddenly need the cloud to have it recognize the Eiffel tower.
• shepherdjerred 2y ago
  It sounds like Apple implemented a feature and went out of the way to preserve privacy. For most users the correct choice here is to enable the feature by default.
  • deleted 2y ago
    [deleted]
• xyst 2y ago
  Got to feed their piss poor "Apple Intelligence", somehow.
• nixpulvis 2y ago
  I'm disappointed in the discourse around Homomorphic Encryption and Differential Privacy here. As someone who briefly studied adjacent subjects these tools excite me more than they scare me. We trust TLS with our SSNs and CC numbers, hopefully one day we can trust secure multiparty computation too.
  • 1shooner 2y ago
    >We trust TLS Is this really an apt comparison? I understood the trust in TLS to be built on open RFCs and implementation stacks. Even then, whenever I send private data, I take specific steps to verify I am using that trusted stack. That is not the experience described in the article.
    • warkdarrior 2y ago
      > I take specific steps to verify I am using that trusted stack I would be very interested to hear what these specific steps are. How do you make sure that this TLS stack really does implement the RFC? How do you know that each connection is indeed encrypted, and it doesn't start sending plaintext after, say 30 days of usage?
• quyleanh 2y ago
  If they advertise "What happens on your iPhone, stays on your iPhone.", these kinds of options must be off by default. Since they are on, I can consider this one and their other statements about privacy lie.
• amazingamazing 2y ago
  [flagged]
  • JTyQZSnP3cQGa8B 2y ago
    > if you use iCloud Photos (only that applies) It's enabled by default for most people, whether they use iCloud or not.
    • amazingamazing 2y ago
      You cannot use iCloud Photos without iCloud. Still not seeing the issue - anyone who cares about their privacy would just turn it off, problem solved.
• jchw 2y ago
  What I want is very simple: I want software that doesn't send anything to the Internet without some explicit intent first. All of that work to try to make this feature plausibly private is cool engineering work, and there's absolutely nothing wrong with implementing a feature like this, but it should absolutely be opt-in. Trust in software will continue to erode until software stops treating end users and their data and resources (e.g. network connections) as the vendor's own playground. Local on-device data shouldn't be leaking out of radio interfaces unexpectedly, period. There should be a user intent tied to any feature where local data is sent out to the network. So why didn't Apple just simply ask for user permission to enable this feature? My cynical opinion is because Apple knows some portion of users would instantly disallow this if prompted, but they feel they know better than those users. I don't like this attitude, and I suspect it is the same reason why there is an increasing discontent growing towards opt-out telemetry, too.
  • miki123211 2y ago
    Opt in doesn't work, it never did. The vast majority (>95%) of users does not understand what those pop-ups say, seems fundamentally incapable of reading them, and either always accepts, always rejects, or always clicks the more visually-appealing button. Try observing a family member who is not in tech and not in the professional managerial class, and ask them what pop-up they just dismissed and why. It's one of the best lessons in the interactions between tech and privacy you can get.
    • Longhanks 2y ago
      Well, then >95% of users won't be using $FEATURE. Simple as that. The fact that users for some reason no not consent to $FEATURE the way corporations/shareholders would want them to does not give anyone the right to stop asking for consent in the first place.
      • zxcvbnm69 2y ago
        [dead]
    • 2y ago
• grishka 2y ago
  > It ought to be up to the individual user to decide their own tolerance for the risk of privacy violations. It's a recurring theme in the modern IT industry that the user can somehow never trusted to take their own responsibility for anything. Like, can I please not have the "added security" on my Android phone where it would sometimes ask me for the pattern instead of the fingerprint? I know my own risks, thank you very much, Google. Same for macOS occasionally making me enter the password instead of letting me unlock with touch ID. Same for a bunch of other random software treating me as a complete technologically illiterate idiot with no way to opt out of this hell. Remember how our devices used to serve us, not the other way around?
  • userbinator 2y ago
    It's the rise of authoritarianism, and its appearance in IT mirrors what's happening in the rest of society too.
• mrshadowgoose 2y ago
  Is this just a smokescreen around slowly sneaking CSAM scanning back in after the pushback last time? The "default on" behavior is suspect. [1] https://www.wired.com/story/apple-photo-scanning-csam-communication-safety-messages/ https://www.wired.com/story/apple-photo-scanning-csam-commun...
  • KerrAvon 2y ago
    No, it is not. Whatever their other failings, Apple doesn’t think that way. The cynical reason: consider that you can’t plan engineering features of this scale without written documentation, which will always surface in court. The prima facie reason: Apple genuinely wants to provide useful features requiring server participation.
    • pkkkzip 2y ago
      This is incredibly naive and curiously defensive. If this was a feature on its own then it would not be popular. Citing national security, some danger will justify its existence. Apple alone does not control and dictate what goes in, once you reach their level of size and wealth that exceed even developed countries, you ultimately cannot be the controller of your destiny purely as a profit orientated corporation. ex) Meta, Microsoft, Google
  • CatWChainsaw 2y ago
    Exactly like how Microsoft "backed off" Recall. Uuuuuntil they shoved it back in and made it undeleteable.
    • sgammon 2y ago
      By removing it from the market, making enormous technical tweaks based on user feedback, and then putting it back on the market.
  • amatecha 2y ago
    Yup, this is their way of injecting the "phone home" element via an innocuous rationale, "location matching". The global index will of course also match against other markers they deem worthy of matching, even if they don't return that to the user.
• kittikitti 2y ago
  Here's a direct link to the paper that describes this as mentioned in the post, https://machinelearning.apple.com/research/homomorphic-encryption https://machinelearning.apple.com/research/homomorphic-encry... The homomorphic code is available in Swift https://www.swift.org/blog/announcing-swift-homomorphic-encryption/ https://www.swift.org/blog/announcing-swift-homomorphic-encr... I have concerns about how women would be affected by law enforcement who might use the location data to target abortions.
  • sgammon 2y ago
    > I have concerns about how women would be affected by law enforcement who might use the location data to target abortions. What? How?
    • CatWChainsaw 2y ago
      police using photos/location to figure out that a woman from Texas went to an address associated with an abortion clinic, and wow Texas has bounties, noooo potential for abuse there. you've really been shilling apple and even obnoxiously giving multiple replies to the same comment, what's your problem?
      • sgammon 2y ago
        > police using photos/location to figure out that a woman from Texas How would they access that information? Under this feature, no location information for the user would be held by Apple's servers. Plus, Apple would have to divulge it somehow to law enforcement, which they don't do as a matter of course until compelled by a court. Courts have a high bar for accessing that information. Even so, having compelled Apple, they cannot give up what they do not have. > you've really been shilling apple I am not "shilling" for Apple, I am commenting about a technology Apple has adopted and which I have decided to trust. > giving multiple replies to the same comment Sometimes I prefer to break my replies up so they are easier to consume. I don't agree with the premise that this is obnoxious and so far none of my counterparties has complained. Why are you complaining? > what's your problem? What's your problem?
• kjreact 2y ago
  Let’s step back and go through the thought process of the team that’s implementing this feature. If they leave the feature disabled by default most likely casual users will never use it because they won’t be able to find the setting buried under all the menus. Thus after adding all their privacy layers the team felt that it should be safe enough to enable by default while remaining true to the company’s ethos of privacy. Now what would you have done differently if you were in charge of rolling out such a feature? While I don’t like Apple phoning home without my consent, in this case my photos are not being sent to Apple; only anonymized hashes used to match well known landmarks. The author of the article goes on to show his bias against Apple with phrases like “You don't even have to hypothesize lies, conspiracies, or malicious intentions on the part of Apple to be suspicious of their privacy claims” or “Apple's QA nowadays is atrocious.” Or this rich quote “I never wanted my iPhone to phone home to Apple.” What smartphone or computing device never communicates back to their company servers? Even when I use open source libraries I have to communicate with repositories to check for dependencies. Does the author hide every online transaction he makes? Never using email or text messages or cloud services which will leak his private information? Unlikely. He just wants to grind his axe against Apple. So let’s step back and look at it reasonably and see if Apple is trying to erode our privacy with this feature. I personally don’t see this particular feature as being harmful, but I will thank the overzealous author of bringing it to my attention and I’ll be disabling the feature since I don’t need it. This feature is no where near as invasive as the CSAM detection tool that was proposed, which did warrant critical discussion. Let’s let the team, undoubtedly one of many with the unenviable task of making Apple Intelligence relevant, who rolled out the feature get their yearly bonus and move on to discuss more enlightening topics such as as the merits of keeping tabs on the urination habits of the crew on the ISS via the Mac menubar.
  • sneak 2y ago
    If Apple can prompt me 4700 times after I’ve said no each time to enable Apple TV and Apple Arcade and Apple Fitness subscriptions, they can prompt users to enable a new feature if they wish.
  • lapcat 2y ago
    > The author of the article goes on to show his bias against Apple My bias against Apple, as someone who exclusively uses and develops software for Apple products? I've been a loyal Mac user for over 20 years. It's so ridiculous when people make an accusation like this. For better or worse, I'm married to Apple platforms.
• gerash 2y ago
  I don't mind the whole use of ML based features even if it requires elaborate schemes to run some computation in the cloud in some privacy preserving manner. However I do see that Apple marketing campaign tried to fool people into thinking somehow non Apple are not private and only Apple provides privacy.
  • CodeWriter23 2y ago
    This obviously requires location services to be enabled. Why does this need ML? Hit a GIS lookup API with the lat/long of the photo.
    • deleted 2y ago
      [deleted]
• mesmertech 2y ago
  looks like its not even available on EU, I'll call that a win
  • pndy 2y ago
    Where are you? I'm in Poland and I just disabled it both on phone and tablet - the setting switcher is "conveniently" placed at the bottom of Photos settings page
• supriyo-biswas 2y ago
  The referenced Apple blog post[1] is pretty clear on what this feature does, and I wish the author at lapcatsoftware (as well as folks here) would have read it too, instead of taking the blog post as-is. Apple has implemented homomorphic encryption[2], which they can use to compute distance metrics such as cosine similarity without revealing the original query/embedding to the server. In the case of photos, an on-device model is first used to detect if a landmark may be possibly present in the image, and then sends an encrypted embedding[3] for the image region containing said landmark, which is evaluated on the server using HE techniques and then the encrypted results are sent back. I'm sure someone will come along and say Apple does none of these things; in which case, said commenter should probably not use Apple devices since, there is no reason to trust the toggles for "Enhanced Visual Search", and perhaps more importantly, the one for "Advanced Data Protection" either. However, I rarely see any other major company researching ML and HE together, so that alone is a sufficient positive indicator in my eyes. (It's interesting that this is also being downvoted. Please go ahead, I can't stop you :P but please also write the parts that you disagree with. Thank you.) [1] https://machinelearning.apple.com/research/homomorphic-encryption https://machinelearning.apple.com/research/homomorphic-encry... [2] https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption [3] https://mlr.cdn-apple.com/video/HE_Fig_3_PNNS_889f3a279c.m4v https://mlr.cdn-apple.com/video/HE_Fig_3_PNNS_889f3a279c.m4v
  • j45 2y ago
    I thought less about the data, as much as the metadata, direct and indirect.
  • penguinburglar 2y ago
    Thank you for posting the apple blog post. As usual, it's really interesting research, and it's fascinating to see how they solve potentially gnarly privacy issues.
    • lapcat 2y ago
      > Thank you for posting the apple blog post. The very same blog post is linked in the submitted article.
• hmage 2y ago
  Reading comments here feels like being on Twitter, Reddit and 4chan combined - a lot of people not listening to each other. What happened to old HN?
  • amazingamazing 2y ago
    Too mainstream, regression to mean.
  • Klonoar 2y ago
    My view is that a large group of people interested in building companies, tools, etc moved on and only come back when there’s a PR issue that pushes then to comment. What’s left behind is basically the same old /. esque crowd from the internet of old.
  • WuxiFingerHold 2y ago
    I've noticed that too. I think it depends on the topic. Many are biased when it comes to Apple (me too). Some even defend their misbehaving. My emotional reaction to Apple misbehaving is usually anger because I somehow feel disappointed, even betrayed by Apple. "Apple, how can you build such gorgeous hardware and still act so unethical?". This is of course irrational: Apple is a company that does everything to grow.
• sitkack 2y ago
  I don't understand why this feature needs to exist at all. Ostensibly, if someone wanted to use this, they also have location data on, the phone not only knows its location but also which direction it is pointed via the magnetometer. I understand it is doing feature matching on the image, but if you were taking a picture of the statue of liberty, the phone would already know that from existing signals.
  • deleted 2y ago
    [deleted]
• rzimmerman 2y ago
  If your core concern is privacy, surely you'd be fine with "no bytes ever leave my device". But that's a big-hammer way to ensure no one sees your private data. What about external (iCloud/general cloud) storage? That's pretty useful, and if all your data is encrypted in such a way that only you can read it, would you consider that private? If done properly, I would say that meets the goal. What if, in addition to storage, I'd like to use some form of cloud compute on my data? If my device preprocesses/anonymizes my data, and the server involved uses homomorphic encryption so that it also can't read my data, is that not also good enough? It's frustrating to see how much above and beyond Apple has taken this simple service to actually preserve user privacy. I get that enabling things by default triggers some old wounds. But I can understand the argument that it's okay to enable off-device use of personal data IF it's completely anonymous and privacy preserving. That actually seems very reasonable. None of the other mega-tech companies come close to this standard.
  • zmgsabst 2y ago
    No — users should be the ones to decide if “encrypted on remote storage” is a beneficial trade off for them and their particular situation. I think there’s some weird impulse to control others behind these decisions — and I oppose that relationship paradigm on its own grounds, independent from privacy: a company has no business making those choices for me. You are free to use such services if you wish; others are free not to use those services.
  • maronato 2y ago
    iCloud is opt in. This should be too. A lot of people are fine with keeping their photos offline-only and syncing with their computers through a cable. Making it “private” with clever encryption is their job since Apple wants to sell privacy. They aren’t doing it because they are nice or care about us. Plus, code is written by people and people write bugs. How can you tell this is truly bug-free and doesn’t leak anything? Ultimately, making it opt-in would be painless and could be enabled with a simple banner explaining the feature after the update or on first boot, like all their opt-in features. Making it opt-out is irresponsible to their branding at best and sketchy to their users at worst, no matter how clever they say it is.
• Aachen 2y ago
  > I don't understand most of the technical details of Apple's blog post. I did understand the cited bits, and sorry to say but this could have been an optimistic post ("look at this cool new thing!") I dislike Apple's anti-hacker (in the HN sense of the word) practices as much as the next person and don't own any Apple device for that and other reasons, but saying "it doesn't matter how you solved the privacy problem, I feel it's not private" doesn't make it true. Because most other people don't understand the cited words either, if they read that far down anyway, this seems like unfair criticism
  • hmottestad 2y ago
    Homomorphic encryption is something I heard about through a research paper a few years ago. Back then I understood that an operation like SUM would be able to compute the sum of a list of numbers where each number was encrypted. The way the encryption worked made it possible to add all the values together without decrypting them, and the result ended up being encrypted too in such a way that the owner could decrypt it and have a number with a certain known accuracy. If Apple is using homomorphic correctly then there should be no way for them to see the data they get from your phone. The other things they mention in the post as ways to prevent leaking of other information through metadata or a side channel. The fact that this feature was enabled by default isn’t exactly great. Definitely should have been something that the user should have been asked if they wanted to enable after upgrading.
    • pdpi 2y ago
      One specific use Apple is making of homomorphic encryption as of iOS 18 (I think) is for spam callers. You get a phone call, your phone sends Apple the encrypted phone number, they run it against their spam caller database, and you get the encrypted spam/not spam response back. They published a bunch of open source code around this functionality a while back. https://www.swift.org/blog/announcing-swift-homomorphic-encryption/ https://www.swift.org/blog/announcing-swift-homomorphic-encr...
      • hmottestad 2y ago
• franczesko 2y ago
  We need to go back to local-first software. I'd be happy to pay premium for a device, which is truly my, without big tech sniffing all my data or deciding what can I do with it
• bambax 2y ago
  Apple TOS: > To uphold our commitment to privacy while delivering these experiences, we have implemented a combination of technologies to help ensure these server lookups are private, efficient, and scalable. Efficiency and scalability have nothing to do with "upholding one's commitment to privacy". This shows they're insincere. But, is privacy achievable today? I doubt it. People desperately want (or think they want) features that are opposite to privacy, and if you don't give it to them, they're unhappy. I think Apple's fault is in promising something they can't deliver. (That also goes for Brave, Kagi, Duck Duck Go, etc.) Scott McNealy famously said "You have zero privacy. Get over it." This was in January 1999. 25 years ago!
  • supermatt 2y ago
    > Efficiency and scalability have nothing to do with "upholding one's commitment to privacy". This shows they're insincere. "private, efficient, and scalable" means "private AND efficient AND scalable". What makes you think they are being insincere about the privacy aspect?
    • bambax 2y ago
      If they said To uphold our commitment to privacy while delivering these experiences, we have implemented a combination of technologies to help ensure these server lookups are private then it would be fine. It would also be a tautology. When they add that server lookups are also "efficient and scalable", it means that they have had to ponder the privacy aspects with technical concerns regarding efficiency and scalability, and that therefore, privacy is mitigated. I think a fair reading of this sentence would be: "we provide a version of 'privacy' that we feel is acceptable, within reasonable efficiency and scalability constraints". They're not going to dedicate a server per customer for example. Would it make sense to do it? No. But it would be honest to say "because of efficiency and scalability limits, the 'privacy' we provide is relative and subject to breaches". (I actually think that's exactly what their wording is trying to say.)
      • supermatt 2y ago
        > I actually think that's exactly what their wording is trying to say. And herein lies the problem, because they are literally saying what they say - private AND efficient AND scalable. You are the one adding hypothetical caveats. They are talking about offloading functionality that cannot occur on device. The scalability and efficiency is not being used as a reason to take privacy away, it is simply an additional requirement of how they must meet their pledge. The quote you are referencing is literally about how these features are implemented using homomorphic encryption to perform lookups on anonymously accessed black boxes: https://machinelearning.apple.com/research/homomorphic-encryption https://machinelearning.apple.com/research/homomorphic-encry... . Which part of that is them sacrificing privacy to make it scalable and efficient, and how would using a dedicated server per user increase privacy? Is there some specific privacy issue you can see with their implementation?
• deleted 2y ago
  [deleted]